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We study the possible application of the decoy state method on a basic two way quantum key 
distribution (QKD) scheme to extend its distance. Noting the obvious advantage of such a QKD 
scheme in allowing for single as well as double photon contributions, we derive relevant lower-bounds 
on the corresponding gains in a practical decoy state implementation using two intensities for decoy 
states. We work with two different approaches in this vein and compare these with an ideal infinite 
■ decoy state case as well as the simulation of the original. 
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D Quantum mechanics which at one time challenged the beliefs of even scientists about nature has come today to be the 
corner stone of many if not all explanations of physical phenomenon at the atomic level. More than that, the theories 
have even seen applicability, mainly in the form of quantum computation [D-Q and quantum cryptography Q . The 
Cn| , latter has seen the light of commercial realizations and to quite an extent has led itself into the world of engineering 
concerns where many challenges are at the level of implementation. 

Quantum cryptography, or more specifically, quantum key distribution (QKD) was arguably born in the seminal 
work of Bennet and Brassard @ with a protocol now popularly known as BB84. Twenty five years later today, the 
field has seen many inventions, improvements and of course plenty important physics discovered. However, despite 
: the various protocols available today, its implementation is still unfortunately less than ultimately desirable. This is 
d given the many imperfections in devices used in its realization, consequently limiting the effective distance to generate 
^ , a secure key between two legitimate parties. Of many, it is arguably the case of the lack of a perfect single photon 
, ^ source technology. However, in [gj, an interesting method called the decoy state method was proposed to compensate 
I and since then has been studied somewhat extensively though limited mostly to BB84 [5| and SARG04 protocol 
^sj ■ [sl-fl^. Before indulging in our intent in this paper, we will briefly mention another family of QKD protocol which 
^ ' can be described by its two way nature. Amongst the earlier works include 13-16]. However, we will extensively 
, make reference to the [l^[3 refer to it as LM05 (this term was noted in flTj). 

The LM05 is analogous to the BB84 in the sense it uses 4 states derived from 2 mutually unbiased bases. It functions 
on the basis of sending a state prepared by one party. Bob to another, Alice and encoding is done by Alice using a 
unitary transformation (identity or a flip). The encoded qubit is then sent back to Bob and a sharp measurement 
may be made. To ensure security, a control mode, (completely analogous to BB84) where Alice would measure the 
received qubit, is executed randomly and results would be compared on a public channel. Given various results on 
specific attacks on the protocol, it is believed that the protocol has some security advantage over prepare and measure 
schemes. This was further noted in when considering the difficulty of cloning unitary transformations compared 
to states. In the case of implementation given imperfect devices, especially in consideration of the notorious imperfect 
single photon source, Lucamarini et al. jl9l| showed that the protocol exhibits a higher secure key rate given certain 
^ distances over the BB84; not surprisingly due to the fact that the LM05 inherently is more robust against a photon 
5^ [ number splitting attack (a two photon pulse is not enough for an eavesdropper to perform such an attack). It is 
unfortunate however, that the two way channel for the protocol suffers losses on a quadratic scale [T6| . 

In this work, we will for the first time, we believe, consider the LM05 using the decoy method with the intention 
of extending the distance for a secure implementation. The fiavor of improvement comes from the fact that LM05 
may allow for key distillation even for 2 photons per-pulse as noted in [19| (which in this sense, similar to that of 
SARG04). In terms of a finite decoy state implementation, we propose two different approaches with the first (at 
least with regards to the double photon contribution) being an echo of the derivations in [9l-[Tl| for a two photon 
contribution. We note some issues relevant therein especially with regards to the lower bound for the gain of a 
double photon contribution, (referred to as Q2) which happens to be a function of the single photon contribution. In 
the second approach, in trying to avoid such dependencies of Q2 on a single photon contribution term, we derive a 
different estimation for the lower bound for the relevant photon contributions and report the results for the different 
techniques. We then compare the distance for a secure key rate with that of a LM05 without decoy implementation. 
Finally we report on a brief comparison with a decoy state BB84 as well as the decoy state SARG04 protocol. 
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II. DECOY STATE AND LM05 



We will consider a simple fiber based setup with a weak pulse for a source. This allows for an immediate import of 
the model in Q with some differences, primarily coming from the two way nature of the protocol. If we consider the 
ideal case where an infinite number of decoy states are used, the conditional probability that Bob registers a detection 
given a pulse with i photons was sent (usually referred to as the yield of the i-th photon) as well the relevant quantum 
bit error rate (QBER) may be estimated respectively by Q 

Y, = Ya+r],- Yorj, (1) 

^ detector'^i 



Y, 



(2) 



where the transmittance, y^j = 1 — (1 — 77)*, rj = trjAB, t = 10^"^'/^°. tjab is the efficiency related to measurement as 
well as encoding apparatus (for simplicity we assume the encoding process is done with unit efhciency) and we note 
the transmittance t acquires a 21 term, i.e. double length I term due to the two way nature of the protocol concerned 
p^ . The term a is the loss coefhcient which reflects the losses in the channel and is measured in dB/km. The gain 
for the i-th and the total gain with a source of intensity fi are given by Yi exp (— and = Yq + I — exp {—rifi) 
Q. However, for a practical setup where finiteness is a reality, we consider the use of 2 decoy states with intensities i^i 
and V2 respectively and a signal state with intensity 11 and reiterate the conditions in [8], 1/1 + 1^2 < ^J■ a-nd I'l + 1/2 < 1- 
However, these conditions do not imply any constraint on the value of fj,, which must be ascertained only through 
maximizing the key rate. We bear in mind, the gains for the 2 decoy states and signal state, Q^-^ , Q^^ and 
respectively, may be observed experimentally. 

The single photon contribution may be imported directly fror n jSj) . In calculating the double photon detection 
probability, it is tempting to adopt immediately the work of |9l-[ll| for SARG04. Before we proceed, let us note 
the formula derived for double photon detection in 0, [loj contains a term for the lower bound of a single photon 
contribution of the form — Yi77yi/(j/i, 1/2, /i). As the function /(i^i, 1/2, fJ-) > in 10] (in ,9], this can also achieved, 
especially when ji > 1/1 + 1/2), in our opinion, this would put some questions on the 'lower bound' nature of the double 
photon formula if Yi is not taken as the upper bound for the single photon contribution (this is especially given that 
Yi itself is not directly measured in experiments and only its lower bound may be estimated) . In this section, we shall 
derive a similar formula with further scrutiny on the lower bound of Y2 . We begin by borrowing from [sl-fTTj , we write 



n—O n— 3 



The second term in the right hand side of the equation highlights our interest in single as well as double photon 
contribution. Writing 



we may thus note 

- Q.,e- < > : 11^11—11 + 1^ \ - K,^ (5) 



n— 3 n—O 




Such an inequality is derived from the fact that a"^ — b'^ > a* — 5% Vi > 3 (we omit the proof for this) . Thus 



Y2 > Yi' = 



^JL^ivi — V2) — '^2\ ^1 ~ 



(6) 



where Yf^ is given by 



yo^^max|-^Q-^"---Q---",0^ (7) 
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If we consider cases where ii > i^i + 1^2, then the numerator for the coefficient of Yi , 



fi'^ivi - V2) - {vl - vl) > {vi + V2f{vi - V2) - {vl - vl) 

= ViV2{vi - 1^2) > 



(8) 



As there is no way of ascertaining the exact value of Yi (one only ascertains its lower bound p]), mathematically 
speaking, the term Yi cannot be taken as anything other than an upper bound lest effectively does not become 
a lower-bound. Such a concern is absent in considering an lower bound for Yi in [8| as it can be expressed with 
no explicit dependency on terms other than Yq. It is tempting to immediately use the value Yi derived from eq.(IT]) 
(this was the choice that was used in [13)) which would be valid in the absence of any Eve's tempering. Let us 
for brevity call this Y^ (the superscript 00 is to reflect infinite decoy states used in the estimation). The nagging 
question is the following; can Yi > Y|°°? We may sweep this under the rug by ignoring the possibility. However for 
the purpose of being rigorous, we need to understand what values Yi may achieve beyond Y^ . This may be seen as 
Eve's tempering. We consider the following inequality immediately implied from eq.(3) 



Q.^e''-> Y^{v^-U2) + 



Yo 



(9) 



where the values of Yi and Y2 are to some extent subject to Eve's influence and an equality only holds when pulses 
containing more than 2 photons are blocked. The dependency on Y2 tells us that one may even go as far as considering 
Y2 = zero to ensure that Yi is 'genuinely' upper-bounded. It is quite evident to see that some trivial algebraic 
manipulation may provide with a channel loss coefficient a > for such an equality to hold (our reference to a is 
made in view of Eve's 'accessible loss' [l^). While this is certainly more reasonable from a strict rigorous perspective 
(to respect the requirement of an upper-bound for Yi), it lacks physical appeal as it requires Eve's tempering to 
include an increasing of the single photon gain, which seems counter-intuitive in the face of any conservative attack 
by Eve. The relevant formulas are then 



Y,^ = 



/i(i^i - 1^2) - i^i + ' 



(10) 



yL _ 



^i'^{Vl-V2) Vl 



(11) 



where Y^ is adopted from [1]. These can then be applied to find and The upper bound for the single photon 
yield, Y^^ can be taken as Y]°° or for a more genuine upper bound, the case for Y^ = 0. We believe the construction 
of the inequalities above to be mathematically sound though an equalities would physically reflect changes in the 
photon statistics. Let us note that similar arguments were made for Y2 in Q when deriving Y^ . 

In deriving the upper bounds for the errors ei and 62 relevant to Yi and Y2 respectively, we write out the equations 
for errors assuming they come only from single, double photon contribution as well as dark pulse. We do note though 
our derivation conveniently forces the Yq term to vanish. 



E^.Q^.e"' = eoYo + eiYiVi + e2Y2^ 



(12) 



which we work out to be 



E.^Q.^e"' - eoYo + eiYiU2 + 63 Y2^ 
EM^e^" = eoYo + e^Y^^l + 62 Ya^ 



S.iQ.ie'^i - E,,Q,,e''^ = eiYi [u^ - V2) + e2Y2^ 



(13) 



E^^Q^e^ - E, 



eiYi (/I - 1^2) + &2Y2 



M - V2 



(14) 
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We then solve for d by eq.((T3])x (^^ _ j^2^ _eq (jjjjjx (i/2 _ j^2-j eq.([T3])x - 1/2) -eq.dHllx - 1/2). This 

gives the following upper-bounds for the respective errors 



(15) 



(16) 



Before we proceed with relevant key rate curves for the above bounds, we will in the following section, consider a 
slightly different approach to derive a lower bound for Yi and Y2 at the same time. 



III. LOWER-BOUND OF Yi + Y2 



While deriving a lower bound for Yi is somewhat dependent only on manipulations of multiphoton pulses, that of 
Y2 is a function of Yi as well (as described in the previous section). In this section we will consider a variation in 
deriving the lower bound for the key rate for LM05. The method will be based on trying to achieve the lower bound 
of Yi and I2 at the same time as opposed to the above. In other words, we should hope to derive a lower bound for 
Yi + Y2 • Let us consider the following 



and 



thus from eq.Q 



0.1 e"^ 



^ ^i^2 2 (^1 + Y2) 2 



i=l ■ i=l 



,6"' < J2 Y{yi - V2) + ^-Y^ ( O^e^ - Yo 



{Yi + Y2) 



YiAi 



Yi/i2 



2 V ^ 2 

Thus a lower bound for Yi + Y2 is given as 



{Yx + Y2)^ 



2y, 



Writing the contribution from the single and double photon gain, Q12 (/i) may be given by 



Qi2(m) = Yie-^ + ye-V 



(ri+Y2) _ 



-e '^11 



we thus define the lower bound on the effective gain as 



2^2 (m) = 



(iv+2i)_„2 



yL 2 



(17) 
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(21) 



In this way, rather than consider the rates Yi, then Y2 separately (correspondingly the gains) we lump them as an 
effective gain. We do admit that there is the need for Y/", though as it is accompanied with a positive coefficient, it 
does not carry the 'upper bound' issue of the earlier section. In principle, one could have exclusively estimated for 
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Yi + 12, though our earlier estimation in that vein (not presented) had provided much poorer key rates. We observed 
that a derivation making use of the lower bound for Yi of eq.(lO) improved the key rate estimation. 

Next, we consider the errors in the channel. If we assume all errors come from single and double photon detection 
(as well as dark counts), we could consider 

E^Q^^eoYoe-^+£Qi2{f-i) (22) 
where £ is the effective error for the effective critical gain. Thus we may upper bound the error, £^ 

This derivation has the advantage that one does not concern oneself with exactly how Eve may manipulate the single 
photon yield and its influence on the double photon contributions individually as long as Q12 is respected. As the 
method here addresses the inclusion of a double photon yield, one may consider the possibility of a similar approach 
to be done for SARG04. However, as the error rates from single and double photon contributions require different 
amount of bits to be discarded in privacy amplification, one must, upon ascertaining the effective error rate (which 
combines that from single as well as double photon contribution) determine the amount of bits to be discarded by 
assuming that it is either fully resulting from single or double photon contribution. We refer to (l2| for the relevant 
formulas. The number of bits based on the larger of the two should then be discarded to assure no underestimation 
of Eve's information had been made. 



A. Key Rate Formulas 



This is not really as straightforward as one would hope for when it comes to two way QKD protocols. The reasoning 
is that, while much work for a complete security proof has been done for prepare and measure schemes (BB84 as 
the pioneering example), literally none has been for the case of LM05. As a matter of fact, to date, to the best of 
our knowledge, the security of such protocols are studied in the context of selected types of attacks and thus lacks 
a proper sense of generality. The only two way QKD scheme receiving a very extensive treatment in terms security 
analysis would be in [2T1|. This is however in the context of continuous variables addressing all types of collective 
Gaussian attack. 

Nevertheless, to consider a fair comparison with the work in [l^ we will use the security as defined in the context 
of individual attacks; an adoption of Lutkenhaus's work [22|. It is instructive to note that while Lutkenhaus's work 
addressed single photon contribution to a secure key, the framework may immediately be extended to include a double 
photon contribution provided the amount of bits discarded for privacy amplification in the double photon case do not 
exceed that for the single photon case. We will provide a heuristic justification for this in the following paragraph. 
Thus, extending from BB84 version in and SARG04's [9l-[ll|. we will consider the key rate formula 

2 

Roo > -Qf,f{E,,)H{Ef,) + Q41 - r{e,)] (24) 

i=l 

and in the practical case, for the above two different approaches respectively 

2 

R > -Q^f{E^)H{E^) + [1 - r{e,)] (25) 

i=l 



R12 > -Q^f{E^)H{E^) + [1 - t(£^)] 



(26) 



where the amount of bits lost due to privacy amplification is given by r(e) = log2 (l + 4e — 4e^) for e < 1/2 and 1 
otherwise. f{Efj_) reflects the efficiency of the error correcting procedure (for simplicity we assume it to be 1.22, thus 
providing for a more pessimistic scenario). H(e) is the binary entropic function given by — e log2 (e) — (1— e) log2 (1 — e). 
It is instructive to note despite the necessary similarity and reference of the above formulas to [9 -[O | , the formula for 
the number of bits discarded for privacy amplification in (9l.[l0j are as prescribed in |12| (which were derived exclusively 



for SARG04). The work in [11| considers a simpler approach, where bits to be discarded are given as binary entropic 
functions of the bit errors noted in single and double photon pulses respectively. It is not clear if these formulas can 
be used for LM05 (probably not though). As we are considering an individual attack framework (not unlike (2^]), our 
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choice of function reflecting bits discarded in privacy amplification is r(e). Before further justifications, let us recall 
from [24l] that the function r was derived from the optimization of the collision probability on the reconciled key given 
Eve's general but individual attack. While it was originally considered only for Eve's attack on a single photon pulse, 
we will argue that one may use it even for a double photon pulse under certain assumptions. The following argument, 
which is constructed in a hypothetical framework is really aimed at upper-bounding Eve's information of a key for 
both single and double photon pulses. 

Heuristically one may imagine a hypothetical scenario where Eve is provided with some 'privileged' information 
depending on the number of photons in a pulse sent after all communications between Alice and Bob have been 
completed; the analysis may then be simplified. The only constraint we prescribe for this privileged information is 
that it should be made available to Eve only after the whole communication between Alice and Bob has ended (at 
least the quantum phase). Say if a single photon state was sent. Eve is later privileged to the knowledge of the 
state originally sent by Bob and in the event of a double photon state, only the basis of the state is divulged. The 
protocol then reduces to a BB84 like setup, where Bob estimates the state Alice sends him by making a measurement 
in the correct basis in the face of disturbance. Eve thus needs to attack only the photon traversing from Alice to 
Bob after the encoding in the backward path. If it was a double photon state, she would have hijacked one of the 
photons in the pulse in the forward path and at the end, may choose the relevant basis to measure while causing 
minimal disturbance to the system. As she knows the state of the qubit in the forward path (or the basis to measure 
a hijacked qubit), her knowledge of Alice's encoding would simply depend on her estimation of the state she attacked, 
which is only of one photon. This can be seen more clearly as follows: Eve's probability of guessing the state in the 
forward path becomes unity whilst in the backward path is dependent on her attack strategy, say J^. Her probability 
of guessing Alice's encoding correctly in both types of pulses thus becomes 1 • effectively identical to a BB84 
individual attack. From an information theoretic perspective, her Shanon information gain of Alice's encoding should 
be given hy 1 — H (J-) , where H is the binary entropic function. With regards to privacy amplification, as r in [22| 
is derived from the collision probability on a reconciled key between Alice and Bob, which is essentially a function 
of in either of the two cases of our concern. Eve effectively attacks only one photon and the amount of bits to be 
discarded by the legitimate parties should therefore be given by r. The argument here is certainly less realistic as it 
is quite unimaginable why such information is leaked to Eve; nevertheless, as it involves much privileged information 
provided to Eve, presumably in her favor, her actual information of the key should probably be less than depicted 
above. Hence we believe that the key rate formula used is a pessimistic estimation for LM05. 

IV. RESULTS AND DISCUSSIONS 

Given formulas we may plot the relevant curves for secure key rate against distance. For the purpose of 

definiteness in calculations, we chose parameters derived from the GYS experiment [1^. Let us first describe the 
curves plotted in figure 1; a curve for infinite decoy state, i?oo is plotted using eq. (p4)) : two curves, R1+2, Ru uses 
eg. d^St with differing considerations on . The first of the two applies = Yj°° and the second considers the 
'genuine' upper-bound of Yi where Y2 = respectively. A fourth curve, i?i2, is plotted using eg. d^ and the final 
curve, Rlmo5 for a non-decoy case, we consider the formula given in [l9j . 

Let us begin by comparing the lower bound for the key rate calculated using the different methods above. From 
figure 1, we note that the key rates Roo and R1+2 (^1°° are used as upper bound for Yi) tends to be essentially the 
same for most of the distances. A more pessimistic approach is seen in Ru {Y^ = 0) which is equivalent to the 
case where the double photon contribution is excluded. Let us note at passing, we do not think this is the scenario 
where one should be much concerned with as argued earlier though it suggests the significance of the two photon 
contribution. This may be further seen from our choice of /i = 1.16 for the key rates of infinite decoy case and the 
case where Yi = Y^ . The choice of a > 1 is hardly surprising if we consider X]i=i(exp (— m))mV*'i i-^- the sum 
of probabilities for a single and double photon contribution in a weak source. Solving for the first derivative equaling 
zero, e~^(2 — /x^)/2 = 0, we readily get a /i = y/2 as the maximum point which is greater than the maximum 1 for a 
single photon contribution only. However the lowest estimation for a secure key is noted for our second approach, i?i2, 
which admittedly is a little disappointing. A more detailed study regarding the behaviors of the key rate estimation 
formulas under limiting cases for the decoy state intensities should help illuminate the differences between them, i.e. 
which would present a better approximation to a tight bound with regards to the infinite decoy case. Nevertheless, 
given the results at the moment, we are prone to think that a more refined method though based on the first should 
be considered as a proper estimation for a finite decoy implementation. On the whole, our practical approach does 
expectedly fall a little short with regards to the ideal infinite decoy case, where the distance is about 90km or so. 

Comparison with the case where one does not employ the decoy state method, Rlmo5 (our plot for the non-decoy 
case is an optimized version where numerics were used to determine the value of fj, to achieve the largest key rate at 
intervals of distance) clearly illustrates how the use of decoy state increases the possible distance for a secure key rate 
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FIG. 1: The above shows five key rate curves, Roo,Ri+2,Ru and R12 with the description in the text. In our plots for finite 
decoy states, we had chosen the values of 1/1 — 0.05, 1^2 = 0. As for the signal intensity, /i — 0.45 was used for both Raa and 
Ri+2- l-i ~ 0.45 and 0.35 were used for Ru and Rr2 respectively. 



almost by a factor of two. This is somewhat encouraging. 

In comparing LM05 to two protocols namely BB84 and SARG04, we consider the case for an infinite decoy scenario. 
In the former, we employ the key rate formula from and for the latter as described in [l2|. The comparison has 
LM05 displaying a more favorable key rate for distances up to almost 36 km against BB84, while for SARG04, its 
advantage is displayed up to a distance of about 80 km. Understandably, it suffers losses greatly as compared to 
both BB84 and SARG04 after that. This can be seen in figure 2. We note that the plot uses (numerically) optimized 
intensity at each distance. We should point out that the comparisons with BB84 and SARG04 does not reflect 
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FIG. 2: The above shows the comparison for the decoy based LM05, BB84 and SARG04 with decoy implementation. All three 
key rates are calculated using the infinite key rate formula. 



conclusiveness. For one, the formulas for the latter two are based on unconditional security proofs and therefore 
promises unconditional secure keys while for L1VI05, the formula is based on independent attacks. Nevertheless given 
the fact that little can be gained by considering the independent attack for BB84 23|, as well as a pessimistic case 
considered for L1VI05, we believe the sketch for the comparison is reasonable. Thus, we remain confident that what 
is presented is very much the pessimistic case for the L1VI05 due to the relatively simple and almost naive treatment 
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for a secure key rate formula. It is known that in two way deterministic protocols like LM05, there is an asymmetry 
between the information shared between Alice and Eve, Bob and Eve and Alice and Bob. The deliberations above 
simply do not take this into account, i.e., as noted in in the case for LM05, one could have considered a reverse 
error correction which may give two way deterministic protocols a better gain. 



While double photon contributions are not deemed to be very significant for a secure key rate in SARG04 [l2|, we 
believe that the case differs for a two way QKD protocol like LM05. This is given the fact that the errors from a single 
and two photon contributions are treated in an identical manner. We see that the finite decoy state case considered 
is quite encouraging and should justify further study on the matter. This should include a proper optimization with 
regards to the intensities as well as an optimal number of decoy states to be used. On a more fundamental level, it 
is noteworthy that LM05, has at its core the issue of how encoding is really 'in' the unitary transformations rather 
than the states sent, hence Eve's estimations of states traveling to and fro in the channel is not immediately equal 
to the encoding. Rather, she only gets a correct estimation of the encoding with a probability of + (1 — F)"^ [l6|. 




where F is the probability of estimating a state correctly (this is assuming an attack where Eve measures, even with 
assistance of ancilla, the qubit sent from Bob to Alice independently of it as it traverses from Alice back to Bob). 
Given the domain oi F e [0.5, 1], we note her estimations as a convex function, thus suggesting a higher tolerance 
towards errors when compared to BB84. It is also not clear if delayed measurements would even benefit Eve given 
the absence of bases revelation (relevant to signal states/ encoding and decoding of qubits) in LM05. A more detailed 
enterprise should see a possibly different formula to be applied in place of t for bits to be discarded due to privacy 
amplification. Hence the study is still very much subject to improvement. 

As far as physical realizations are concerned, given the already available experiments on LM05 T^ , an implemen- 
tation of the decoy state is certainly feasible. 

We would like to thank Marco Lucamarini, Faroukh Mukhamedov, Ressa Said and Chi-Hang Fred Fung for 
helpful discussions. We would also like to thank the reviewers for their most helpful comments allowing us to improve 
the work. 
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